Privacy Policy

• Account information: name, email address, password (stored as a secure hash) and the role you choose (fan, artist, venue, promoter). If you sign in with Google, we receive your name, email and profile picture from Google.
• Listings and content you create: events, venue/artist profiles, deals, gigs, hiring posts, marketplace products, reviews, nominations and photos or flyers you upload.
• Purchases and bookings: order details, tickets, RSVPs, gift card codes and booking requests. Card payments are processed by Stripe — we never see or store your full card number.
• Rewards and loyalty: program memberships, points activity, optional birthday (month/day only) and an optional photo you may add to your digital membership card.
• Voice recordings: if you use a voice feature (Sandy voice chat or voice event import), the recording is sent securely for transcription, used to fulfill your request, and is not kept as audio afterwards.
• Connected social accounts: if you connect a Facebook Page, we receive the Page ID, Page name and an access token so we can import that Page's public events. We never receive your Facebook password.
• Technical data: browser type, device information, and cookies needed for secure login sessions.

• To operate the platform: accounts, listings, search, bookings, orders, tickets, rewards and notifications.
• To process payments and payouts through Stripe.
• To send transactional emails (receipts, tickets, gift cards, booking confirmations) and — only with your consent — marketing or rewards digests.
• To power AI features (Sandy assistant, flyer and voice extraction). Content you submit to these features is processed by our AI providers solely to generate the response.
• To prevent fraud, enforce our Terms of Use and comply with the law.

• We do not sell your personal information.
• We do not post to your social accounts.
• We do not store full payment card numbers on our servers.

When you connect a Facebook Page you manage, we access only the data needed to import your Page's events: the Page ID, Page name and its public event details (title, date, time, location, description and image). Access tokens are stored securely and only the last characters are ever displayed. You can disconnect a Page at any time from Dashboard → Bulk Import → Social Connections, which stops all further access. To also remove previously imported events, delete them from your dashboard or contact us (Section 8).

We share data only with the providers required to run the platform: Stripe (payments), our email delivery provider (transactional email), our AI providers (assistant, transcription and extraction requests), Meta (when you connect a Facebook Page) and our cloud hosting/storage providers. Each provider receives only what it needs to perform its service.

We use a secure, httpOnly session cookie to keep you signed in, and local browser storage for preferences (like a dismissed banner). We do not use third-party advertising cookies.

We keep your information while your account is active. Order and payment records are retained as required for accounting and legal purposes. Voice recordings are processed for transcription and not retained as audio.

You can edit your profile and most content directly from your dashboard. To request a copy of your data, correct something you cannot edit yourself, or permanently delete your account and personal data, email us at gulfcoastclub@gmail.com from your account email with the subject "Data request". We complete deletion requests within 30 days, except records we must keep by law (such as tax records of purchases).

Facebook data deletion: disconnecting your Page (Dashboard → Bulk Import → Social Connections → Disconnect) immediately deletes the stored access token. Emailing us with subject "Facebook data deletion" removes any remaining imported Page data.

Gulf Coast VIP is not directed to children under 13, and we do not knowingly collect their personal information. Some listed events are 18+ or 21+ as marked.

We use encrypted connections (HTTPS), hashed passwords, access-controlled infrastructure and secured tokens. No online service is 100% secure, but we work to protect your information and will notify affected users of any breach as required by law.

We may update this policy and will change the date above when we do. Questions? Email gulfcoastclub@gmail.com.